eval_by_design
After a successful license, adp_download_premium() POSTs the license key to https://dp-starter.khalid.digital/premium and writes the JSON files object to option adp_premium_files. adp_load_premium_code() runs from the main plugin file on every request (front-end included) whenever adp_is_licensed() is true: it re-downloads when transient adp_premium_fresh is missing (daily), AES-256-GCM-decrypts the named 'display' blob with a key derived from the license key (str_pad(substr(strtoupper(str_replace('-','',$key)),0,32),32,'0')), and eval()s the plaintext. There is no public-key signature, hash allow-list, or on-disk reviewed file — AES-GCM only proves the Worker that knows the license key produced the ciphertext, and that Worker can change the PHP at the next refresh without a plugin update. The zip ships settings/metabox/license only; the public disclosure renderer is entirely this eval'd module, so a compromised or malicious Worker is site RCE plus a skimmer-class HTML injection on every disclosed post. A second path from the same host: adp_check_plugin_update() GETs /update-check?product=affiliate-disclosure-pro with no license check and copies data.download_url into the update_plugins transient package field (no zip hash). adp_force_update_check on admin_init (no capability) can delete that transient once per hour, including from unauthenticated admin-ajax.php, accelerating the next fetch. This is vendor DRM rather than a hidden webshell, but it is persistent DB-stored PHP execution scanners will not see in wp-content/plugins.
inc/license.php:299-354
RecommendationShip the display PHP in the plugin zip (or extract a signed package onto disk and include those files). Do not eval() option-stored blobs. If remote delivery stays, verify an Ed25519/public-key signature over the plaintext, pin the Worker identity, and fail closed on mismatch. Stop injecting an unsigned download_url into update_plugins; at least require a sha256 of the zip. Gate adp_force_update_check behind manage_options (or remove it).